@tidecloak/js 0.14.2 → 0.14.7

package/dist/types/lib/tidecloak.d.ts

@@ -1,9 +1,65 @@
-export { shouldAttachDpopProof } from "./secureFetchPolicy.js";
-export default class TideCloak {
+/**
+ * @import {Acr, TideCloakAccountOptions, TideCloakAdapter, TideCloakConfig, TideCloakError, TideCloakFlow, TideCloakInitOptions, TideCloakLoginOptions, TideCloakLogoutOptions, TideCloakPkceMethod, TideCloakProfile, TideCloakRegisterOptions, TideCloakResourceAccess, TideCloakResponseMode, TideCloakResponseType, TideCloakRoles, TideCloakTokenParsed, OpenIdProviderMetadata} from "./tidecloak.js"
+ */
+import type { TideCloakAccountOptions, TideCloakConfig, TideCloakError, TideCloakFlow, TideCloakInitOptions, TideCloakLoginOptions, TideCloakLogoutOptions, TideCloakPkceMethod, TideCloakProfile, TideCloakRegisterOptions, TideCloakResourceAccess, TideCloakResponseMode, TideCloakResponseType, TideCloakRoles, TideCloakTokenParsed } from "./tidecloak.js";
+export type Endpoints = {
+    authorize: () => string;
+    token: () => string;
+    logout: () => string;
+    checkSessionIframe: () => string;
+    thirdPartyCookiesIframe?: (() => string) | undefined;
+    register: () => string;
+    userinfo: () => string;
+};
+export type LoginIframe = {
+    enable: boolean;
+    callbackList: ((error: Error | null, value?: boolean) => void)[];
+    interval: number;
+    iframe?: HTMLIFrameElement | undefined;
+    iframeOrigin?: string | undefined;
+};
+export { shouldAttachDpopProof } from './secureFetchPolicy.js';
+export { RequestEnclave, ApprovalEnclave, ApprovalEnclaveNew, PolicySignRequest } from "heimdall-tide";
+export { Tools, Models } from "@tideorg/js";
+export type ParsedCallbackParams = {
+    paramsString: string;
+    oauthParams: Record<string, string | undefined>;
+};
+export type AccessTokenResponse = {
     /**
-     * @param {TideCloakConfig} config
+     * The access token issued by the authorization server.
      */
-    constructor(config: TideCloakConfig);
+    access_token: string;
+    /**
+     * The type of the token issued by the authorization server.
+     */
+    token_type: string;
+    /**
+     * The lifetime in seconds of the access token.
+     */
+    expires_in?: number;
+    /**
+     * The refresh token issued by the authorization server.
+     */
+    refresh_token?: string;
+    /**
+     * The ID token issued by the authorization server, if requested.
+     */
+    id_token?: string;
+    /**
+     * The scope of the access token.
+     */
+    scope?: string;
+    /**
+     * The Tide doken issued by the authorization server.
+     */
+    doken?: string;
+};
+export default class TideCloak {
+    #private;
+    useDPoP: import("./tidecloak.js").DPoPConfig | undefined;
+    dpopSigningAlgValuesSupported: string[] | undefined;
+    issuer: string | undefined;
     didInitialize: boolean;
     authenticated: boolean;
     loginRequired: boolean;
@@ -34,7 +90,7 @@ export default class TideCloak {
     pkceMethod: TideCloakPkceMethod;
     enableLogging: boolean;
     /** @type {'GET' | 'POST'} */
-    logoutMethod: "GET" | "POST";
+    logoutMethod: 'GET' | 'POST';
     /** @type {string=} */
     scope: string | undefined;
     messageReceiveTimeout: number;
@@ -95,15 +151,16 @@ export default class TideCloak {
     /** @type {(authenticated: boolean) => void=} */
     onReady: ((authenticated: boolean) => void) | undefined;
     /** @type {(status: 'success' | 'cancelled' | 'error', action: string) => void=} */
-    onActionUpdate: ((status: "success" | "cancelled" | "error", action: string) => void) | undefined;
+    onActionUpdate: ((status: 'success' | 'cancelled' | 'error', action: string) => void) | undefined;
+    /**
+     * @param {TideCloakConfig} config
+     */
+    constructor(config: TideCloakConfig);
     /**
      * @param {TideCloakInitOptions} initOptions
      * @returns {Promise<boolean>}
      */
     init: (initOptions?: TideCloakInitOptions) => Promise<boolean>;
-    useDPoP: import("./tidecloak.js").DPoPConfig | undefined;
-    dpopSigningAlgValuesSupported: string[] | undefined;
-    issuer: string | undefined;
     /**
      * @param {TideCloakLoginOptions} [options]
      * @returns {Promise<void>}
@@ -265,25 +322,19 @@ export default class TideCloak {
         encrypted: string | Uint8Array;
         tags: string[];
     }[], decryption_policy?: Uint8Array): Promise<(string | Uint8Array)[]>;
-    #private;
-}
-/**
- * @typedef {Object} NetworkErrorOptionsProperties
- * @property {Response} response
- * @typedef {ErrorOptions & NetworkErrorOptionsProperties} NetworkErrorOptions
- */
-export class NetworkError extends Error {
-    /**
-     * @param {string} message
-     * @param {NetworkErrorOptions} options
-     */
-    constructor(message: string, options: NetworkErrorOptions);
-    /** @type {Response} */
-    response: Response;
 }
-/**
- * The JSON version of the adapter configuration.
- */
+export type CallbackState = {
+    state: string;
+    nonce: string;
+    redirectUri: string;
+    loginOptions?: TideCloakLoginOptions;
+    prompt?: TideCloakLoginOptions['prompt'];
+    pkceCodeVerifier?: string;
+};
+export type CallbackStorage = {
+    get: (state?: string) => CallbackState | null;
+    add: (state: CallbackState) => void;
+};
 export type JsonConfig = {
     /**
      * The URL of the authentication server.
@@ -298,52 +349,21 @@ export type JsonConfig = {
      */
     resource: string;
 };
-export type Endpoints = {
-    authorize: () => string;
-    token: () => string;
-    logout: () => string;
-    checkSessionIframe: () => string;
-    thirdPartyCookiesIframe?: (() => string) | undefined;
-    register: () => string;
-    userinfo: () => string;
-};
-export type LoginIframe = {
-    enable: boolean;
-    callbackList: ((error: Error | null, value?: boolean) => void)[];
-    interval: number;
-    iframe?: HTMLIFrameElement | undefined;
-    iframeOrigin?: string | undefined;
-};
-export type CallbackState = {
-    state: string;
-    nonce: string;
-    redirectUri: string;
-    loginOptions?: TideCloakLoginOptions | undefined;
-    prompt?: TideCloakLoginOptions["prompt"];
-    pkceCodeVerifier?: string | undefined;
-};
-export type CallbackStorage = {
-    get: (state?: string) => CallbackState | null;
-    add: (state: CallbackState) => void;
-};
 export type NetworkErrorOptionsProperties = {
     response: Response;
 };
 export type NetworkErrorOptions = ErrorOptions & NetworkErrorOptionsProperties;
-import type { TideCloakResponseMode } from "./tidecloak.js";
-import type { TideCloakResponseType } from "./tidecloak.js";
-import type { TideCloakFlow } from "./tidecloak.js";
-import type { TideCloakPkceMethod } from "./tidecloak.js";
-import type { TideCloakTokenParsed } from "./tidecloak.js";
-import type { TideCloakRoles } from "./tidecloak.js";
-import type { TideCloakResourceAccess } from "./tidecloak.js";
-import type { TideCloakProfile } from "./tidecloak.js";
-import type { TideCloakError } from "./tidecloak.js";
-import type { TideCloakInitOptions } from "./tidecloak.js";
-import type { TideCloakLoginOptions } from "./tidecloak.js";
-import type { TideCloakLogoutOptions } from "./tidecloak.js";
-import type { TideCloakRegisterOptions } from "./tidecloak.js";
-import type { TideCloakAccountOptions } from "./tidecloak.js";
-import type { TideCloakConfig } from "./tidecloak.js";
-export { RequestEnclave, ApprovalEnclave, ApprovalEnclaveNew, PolicySignRequest } from "heimdall-tide";
-export { Tools, Models } from "@tideorg/js";
+/**
+ * @typedef {Object} NetworkErrorOptionsProperties
+ * @property {Response} response
+ * @typedef {ErrorOptions & NetworkErrorOptionsProperties} NetworkErrorOptions
+ */
+export declare class NetworkError extends Error {
+    /** @type {Response} */
+    response: Response;
+    /**
+     * @param {string} message
+     * @param {NetworkErrorOptions} options
+     */
+    constructor(message: string, options: NetworkErrorOptions);
+}

package/dist/types/policy-react.d.ts

@@ -1 +1 @@
-export {};
+export * from '@tidecloak/policy/react';

package/dist/types/src/AdminAPI.d.ts

@@ -1,8 +1,12 @@
-export default adminAPI;
-declare const adminAPI: AdminAPI;
-export class AdminAPI {
-    constructor(realm: any);
+/**
+ * AdminAPI - Keycloak Admin REST API client
+ *
+ * Provides methods to interact with the Keycloak Admin REST API
+ * using the IAMService for authentication.
+ */
+declare class AdminAPI {
     realm: any;
+    constructor(realm: any);
     /**
      * Set the realm for API calls
      */
@@ -116,3 +120,6 @@ export class AdminAPI {
     approveChangeSetWithSignature(changeSet: Object, signedRequest: string): Promise<any>;
     getAccessLogs(params?: {}): Promise<any>;
 }
+declare const adminAPI: AdminAPI;
+export default adminAPI;
+export { AdminAPI };

package/dist/types/src/IAMService.d.ts

@@ -1,6 +1,4 @@
-export { IAMServiceInstance as IAMService };
-export default IAMServiceInstance;
-declare const IAMServiceInstance: IAMService;
+import TideCloak, { RequestEnclave } from "../lib/tidecloak.js";
 /**
  * Singleton IAMService wrapping the TideCloak client.
  *
@@ -111,7 +109,7 @@ declare class IAMService {
     _hybridAuthenticated: boolean;
     _hybridReturnUrl: string | null;
     _hybridCallbackHandled: boolean;
-    _hybridCallbackPromise: any;
+    _hybridCallbackPromise: Promise<boolean> | null;
     _cachedCallbackData: {
         isCallback: boolean;
         code: string;
@@ -136,7 +134,7 @@ declare class IAMService {
     _nativeTokens: any;
     _nativeCallbackUnsubscribe: any;
     _nativeCallbackHandled: boolean;
-    _nativeCallbackPromise: any;
+    _nativeCallbackPromise: Promise<boolean> | null;
     _nativeCallbackProcessing: boolean;
     _nativeDoken: any;
     _nativeDokenParsed: Object | null;
@@ -146,13 +144,14 @@ declare class IAMService {
     _pendingEncryptionRequests: Map<any, any>;
     _dpopProvider: import("../lib/tidecloak-dpop.js").DPoPSignatureProvider | null;
     _frontchannelInitPromise: Promise<boolean> | null;
+    constructor();
     /**
      * Register an event listener.
      * @param {'ready'|'initError'|'authSuccess'|'authError'|'authRefreshSuccess'|'authRefreshError'|'logout'|'tokenExpired'} event
      * @param {Function} handler
      * @returns {this}
      */
-    on(event: "ready" | "initError" | "authSuccess" | "authError" | "authRefreshSuccess" | "authRefreshError" | "logout" | "tokenExpired", handler: Function): this;
+    on(event: 'ready' | 'initError' | 'authSuccess' | 'authError' | 'authRefreshSuccess' | 'authRefreshError' | 'logout' | 'tokenExpired', handler: Function): this;
     /**
      * Unregister an event listener.
      * @param {string} event
@@ -457,9 +456,9 @@ declare class IAMService {
      * }
      */
     getHybridCallbackData(opts?: {
-        clearStorage?: boolean | undefined;
-        redirectUri?: string | undefined;
-        provider?: string | undefined;
+        clearStorage?: boolean;
+        redirectUri?: string;
+        provider?: string;
     }): {
         isCallback: boolean;
         code: string;
@@ -601,5 +600,6 @@ declare class IAMService {
      */
     destroy(): void;
 }
-import TideCloak from "../lib/tidecloak.js";
-import { RequestEnclave } from "../lib/tidecloak.js";
+declare const IAMServiceInstance: IAMService;
+export { IAMServiceInstance as IAMService };
+export default IAMServiceInstance;

package/dist/types/src/index.d.ts

@@ -1,9 +1,15 @@
-export { default as IAMService } from "./IAMService.js";
-export type NativeAdapter = import("./types.js").NativeAdapter;
-export type NativeTokenData = import("./types.js").NativeTokenData;
-export type NativeAuthCallbackResult = import("./types.js").NativeAuthCallbackResult;
-export type NativeEncryptionCallbackResult = import("./types.js").NativeEncryptionCallbackResult;
-export type NativeConfig = import("./types.js").NativeConfig;
-export { default as TideCloak, RequestEnclave, ApprovalEnclaveNew } from "../lib/tidecloak.js";
+export { default as IAMService } from './IAMService.js';
+export { default as TideCloak } from "../lib/tidecloak.js";
+export { RequestEnclave, ApprovalEnclaveNew } from "../lib/tidecloak.js";
 export { Tools, Models } from "@tideorg/js";
-export { default as AdminAPI, AdminAPI as AdminAPIClass } from "./AdminAPI.js";
+export type NativeAdapter = import('./types.js').NativeAdapter;
+export type NativeTokenData = import('./types.js').NativeTokenData;
+export type NativeAuthCallbackResult = import('./types.js').NativeAuthCallbackResult;
+export type NativeEncryptionCallbackResult = import('./types.js').NativeEncryptionCallbackResult;
+export type NativeConfig = import('./types.js').NativeConfig;
+/** @typedef {import('./types.js').NativeAdapter} NativeAdapter */
+/** @typedef {import('./types.js').NativeTokenData} NativeTokenData */
+/** @typedef {import('./types.js').NativeAuthCallbackResult} NativeAuthCallbackResult */
+/** @typedef {import('./types.js').NativeEncryptionCallbackResult} NativeEncryptionCallbackResult */
+/** @typedef {import('./types.js').NativeConfig} NativeConfig */
+export { default as AdminAPI, AdminAPI as AdminAPIClass } from './AdminAPI.js';

package/dist/types/src/policy-react.d.ts

@@ -1 +1 @@
-export {};
+export * from '@tidecloak/policy/react';

package/dist/types/src/utils/fetch.d.ts

@@ -8,4 +8,4 @@
  * @returns {Promise<any>} Parsed JSON response
  * @throws {Error} If request fails (with status and body properties)
  */
-export function fetchJson(url: string, options?: RequestInit): Promise<any>;
+export declare function fetchJson(url: string, options?: RequestInit): Promise<any>;

package/dist/types/src/utils/index.d.ts

@@ -1,4 +1,4 @@
-export { fetchJson } from "./fetch.js";
-export { buildInitOptions } from "./initOptions.js";
-export { makePkce, randomPkceVerifier, base64UrlEncode } from "./pkce.js";
-export { resolveSilentCheckSsoRedirectUri, SILENT_CHECK_SSO_FILENAME } from "./silentCheckSso.js";
+export { makePkce, randomPkceVerifier, base64UrlEncode } from './pkce.js';
+export { fetchJson } from './fetch.js';
+export { resolveSilentCheckSsoRedirectUri, SILENT_CHECK_SSO_FILENAME } from './silentCheckSso.js';
+export { buildInitOptions } from './initOptions.js';

package/dist/types/src/utils/initOptions.d.ts

@@ -62,7 +62,7 @@
  *   `undefined` when no correct URI could be derived.
  * @returns {Object} Options for `TideCloak.init()`.
  */
-export function buildInitOptions({ config, setupRequestEnclave, silentCheckSsoRedirectUri, }: {
+export declare function buildInitOptions({ config, setupRequestEnclave, silentCheckSsoRedirectUri, }: {
     config: Object | null | undefined;
     setupRequestEnclave: boolean;
     silentCheckSsoRedirectUri: string | undefined;

package/dist/types/src/utils/pkce.d.ts

@@ -6,18 +6,18 @@
  * @param {number} len - Length of the verifier (default 96)
  * @returns {string} Random verifier string
  */
-export function randomPkceVerifier(len?: number): string;
+export declare function randomPkceVerifier(len?: number): string;
 /**
  * Base64 URL encode an ArrayBuffer.
  * @param {ArrayBuffer} arrayBuffer - Buffer to encode
  * @returns {string} Base64 URL encoded string
  */
-export function base64UrlEncode(arrayBuffer: ArrayBuffer): string;
+export declare function base64UrlEncode(arrayBuffer: ArrayBuffer): string;
 /**
  * Generate PKCE verifier and challenge.
  * @returns {Promise<{verifier: string, challenge: string, method: string}>}
  */
-export function makePkce(): Promise<{
+export declare function makePkce(): Promise<{
     verifier: string;
     challenge: string;
     method: string;

package/dist/types/src/utils/silentCheckSso.d.ts

@@ -1,28 +1,3 @@
-/**
- * @typedef {object} SilentCheckSsoResolution
- * @property {string|undefined} uri    The resolved URI, or undefined if none could be derived.
- * @property {'config'|'base-href'|'redirect-uri-convention'|'redirect-uri'|'origin-root'|'none'} source
- * @property {string} [reason]         Why resolution failed (only when `uri` is undefined).
- */
-/**
- * Resolve the silent-check-SSO redirect URI.
- *
- * Pure: every environment input is passed in explicitly, so this is unit-testable
- * with no DOM. See the module docblock for the resolution order.
- *
- * @param {object} params
- * @param {string} params.origin        The app's origin (`window.location.origin`).
- * @param {string} [params.configured]  Caller-supplied `silentCheckSsoRedirectUri`.
- * @param {string} [params.baseHref]    `document.baseURI`, but ONLY when a `<base href>` element exists.
- * @param {string} [params.redirectUri] Caller-supplied OIDC `redirectUri`.
- * @returns {SilentCheckSsoResolution}
- */
-export function resolveSilentCheckSsoRedirectUri({ origin, configured, baseHref, redirectUri }?: {
-    origin: string;
-    configured?: string | undefined;
-    baseHref?: string | undefined;
-    redirectUri?: string | undefined;
-}): SilentCheckSsoResolution;
 /**
  * Resolution of the silent-check-SSO redirect URI.
  *
@@ -68,15 +43,40 @@ export function resolveSilentCheckSsoRedirectUri({ origin, configured, baseHref,
  * SKIP the silent check rather than emit a URI that will 400.
  */
 /** Filename the SDK ships and that hosting providers are expected to serve. */
-export const SILENT_CHECK_SSO_FILENAME: "silent-check-sso.html";
+export declare const SILENT_CHECK_SSO_FILENAME = "silent-check-sso.html";
 export type SilentCheckSsoResolution = {
     /**
      * The resolved URI, or undefined if none could be derived.
      */
     uri: string | undefined;
-    source: "config" | "base-href" | "redirect-uri-convention" | "redirect-uri" | "origin-root" | "none";
+    source: 'config' | 'base-href' | 'redirect-uri-convention' | 'redirect-uri' | 'origin-root' | 'none';
     /**
      * Why resolution failed (only when `uri` is undefined).
      */
-    reason?: string | undefined;
+    reason?: string;
 };
+/**
+ * @typedef {object} SilentCheckSsoResolution
+ * @property {string|undefined} uri    The resolved URI, or undefined if none could be derived.
+ * @property {'config'|'base-href'|'redirect-uri-convention'|'redirect-uri'|'origin-root'|'none'} source
+ * @property {string} [reason]         Why resolution failed (only when `uri` is undefined).
+ */
+/**
+ * Resolve the silent-check-SSO redirect URI.
+ *
+ * Pure: every environment input is passed in explicitly, so this is unit-testable
+ * with no DOM. See the module docblock for the resolution order.
+ *
+ * @param {object} params
+ * @param {string} params.origin        The app's origin (`window.location.origin`).
+ * @param {string} [params.configured]  Caller-supplied `silentCheckSsoRedirectUri`.
+ * @param {string} [params.baseHref]    `document.baseURI`, but ONLY when a `<base href>` element exists.
+ * @param {string} [params.redirectUri] Caller-supplied OIDC `redirectUri`.
+ * @returns {SilentCheckSsoResolution}
+ */
+export declare function resolveSilentCheckSsoRedirectUri({ origin, configured, baseHref, redirectUri }?: {
+    origin: string;
+    configured?: string;
+    baseHref?: string;
+    redirectUri?: string;
+}): SilentCheckSsoResolution;

package/dist/types/utils/fetch.d.ts

@@ -8,4 +8,4 @@
  * @returns {Promise<any>} Parsed JSON response
  * @throws {Error} If request fails (with status and body properties)
  */
-export function fetchJson(url: string, options?: RequestInit): Promise<any>;
+export declare function fetchJson(url: string, options?: RequestInit): Promise<any>;

package/dist/types/utils/index.d.ts

@@ -1,4 +1,4 @@
-export { fetchJson } from "./fetch.js";
-export { buildInitOptions } from "./initOptions.js";
-export { makePkce, randomPkceVerifier, base64UrlEncode } from "./pkce.js";
-export { resolveSilentCheckSsoRedirectUri, SILENT_CHECK_SSO_FILENAME } from "./silentCheckSso.js";
+export { makePkce, randomPkceVerifier, base64UrlEncode } from './pkce.js';
+export { fetchJson } from './fetch.js';
+export { resolveSilentCheckSsoRedirectUri, SILENT_CHECK_SSO_FILENAME } from './silentCheckSso.js';
+export { buildInitOptions } from './initOptions.js';

package/dist/types/utils/initOptions.d.ts

@@ -62,8 +62,8 @@
  *   `undefined` when no correct URI could be derived.
  * @returns {Object} Options for `TideCloak.init()`.
  */
-export function buildInitOptions({ config, setupRequestEnclave, silentCheckSsoRedirectUri, }: {
-    config: any | null | undefined;
+export declare function buildInitOptions({ config, setupRequestEnclave, silentCheckSsoRedirectUri, }: {
+    config: Object | null | undefined;
     setupRequestEnclave: boolean;
     silentCheckSsoRedirectUri: string | undefined;
-}): any;
+}): Object;

package/dist/types/utils/pkce.d.ts

@@ -6,18 +6,18 @@
  * @param {number} len - Length of the verifier (default 96)
  * @returns {string} Random verifier string
  */
-export function randomPkceVerifier(len?: number): string;
+export declare function randomPkceVerifier(len?: number): string;
 /**
  * Base64 URL encode an ArrayBuffer.
  * @param {ArrayBuffer} arrayBuffer - Buffer to encode
  * @returns {string} Base64 URL encoded string
  */
-export function base64UrlEncode(arrayBuffer: ArrayBuffer): string;
+export declare function base64UrlEncode(arrayBuffer: ArrayBuffer): string;
 /**
  * Generate PKCE verifier and challenge.
  * @returns {Promise<{verifier: string, challenge: string, method: string}>}
  */
-export function makePkce(): Promise<{
+export declare function makePkce(): Promise<{
     verifier: string;
     challenge: string;
     method: string;

package/dist/types/utils/silentCheckSso.d.ts

@@ -1,28 +1,3 @@
-/**
- * @typedef {object} SilentCheckSsoResolution
- * @property {string|undefined} uri    The resolved URI, or undefined if none could be derived.
- * @property {'config'|'base-href'|'redirect-uri-convention'|'redirect-uri'|'origin-root'|'none'} source
- * @property {string} [reason]         Why resolution failed (only when `uri` is undefined).
- */
-/**
- * Resolve the silent-check-SSO redirect URI.
- *
- * Pure: every environment input is passed in explicitly, so this is unit-testable
- * with no DOM. See the module docblock for the resolution order.
- *
- * @param {object} params
- * @param {string} params.origin        The app's origin (`window.location.origin`).
- * @param {string} [params.configured]  Caller-supplied `silentCheckSsoRedirectUri`.
- * @param {string} [params.baseHref]    `document.baseURI`, but ONLY when a `<base href>` element exists.
- * @param {string} [params.redirectUri] Caller-supplied OIDC `redirectUri`.
- * @returns {SilentCheckSsoResolution}
- */
-export function resolveSilentCheckSsoRedirectUri({ origin, configured, baseHref, redirectUri }?: {
-    origin: string;
-    configured?: string;
-    baseHref?: string;
-    redirectUri?: string;
-}): SilentCheckSsoResolution;
 /**
  * Resolution of the silent-check-SSO redirect URI.
  *
@@ -68,15 +43,40 @@ export function resolveSilentCheckSsoRedirectUri({ origin, configured, baseHref,
  * SKIP the silent check rather than emit a URI that will 400.
  */
 /** Filename the SDK ships and that hosting providers are expected to serve. */
-export const SILENT_CHECK_SSO_FILENAME: "silent-check-sso.html";
+export declare const SILENT_CHECK_SSO_FILENAME = "silent-check-sso.html";
 export type SilentCheckSsoResolution = {
     /**
      * The resolved URI, or undefined if none could be derived.
      */
     uri: string | undefined;
-    source: "config" | "base-href" | "redirect-uri-convention" | "redirect-uri" | "origin-root" | "none";
+    source: 'config' | 'base-href' | 'redirect-uri-convention' | 'redirect-uri' | 'origin-root' | 'none';
     /**
      * Why resolution failed (only when `uri` is undefined).
      */
     reason?: string;
 };
+/**
+ * @typedef {object} SilentCheckSsoResolution
+ * @property {string|undefined} uri    The resolved URI, or undefined if none could be derived.
+ * @property {'config'|'base-href'|'redirect-uri-convention'|'redirect-uri'|'origin-root'|'none'} source
+ * @property {string} [reason]         Why resolution failed (only when `uri` is undefined).
+ */
+/**
+ * Resolve the silent-check-SSO redirect URI.
+ *
+ * Pure: every environment input is passed in explicitly, so this is unit-testable
+ * with no DOM. See the module docblock for the resolution order.
+ *
+ * @param {object} params
+ * @param {string} params.origin        The app's origin (`window.location.origin`).
+ * @param {string} [params.configured]  Caller-supplied `silentCheckSsoRedirectUri`.
+ * @param {string} [params.baseHref]    `document.baseURI`, but ONLY when a `<base href>` element exists.
+ * @param {string} [params.redirectUri] Caller-supplied OIDC `redirectUri`.
+ * @returns {SilentCheckSsoResolution}
+ */
+export declare function resolveSilentCheckSsoRedirectUri({ origin, configured, baseHref, redirectUri }?: {
+    origin: string;
+    configured?: string;
+    baseHref?: string;
+    redirectUri?: string;
+}): SilentCheckSsoResolution;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tidecloak/js",
-  "version": "0.14.2",
+  "version": "0.14.7",
   "description": "Vanilla JavaScript/browser SDK for TideCloak with an IAMService singleton and low-level client.",
   "type": "module",
   "main": "dist/cjs/src/index.js",
@@ -57,11 +57,11 @@
     "authorization"
   ],
   "dependencies": {
-    "heimdall-tide": "^0.14.2",
-    "@tideorg/js": "^0.14.2"
+    "heimdall-tide": "^0.14.7",
+    "@tideorg/js": "^0.14.7"
   },
   "peerDependencies": {
-    "@tidecloak/policy": "^0.14.2"
+    "@tidecloak/policy": "^0.14.7"
   },
   "peerDependenciesMeta": {
     "@tidecloak/policy": {